At first glance, a lease appears to be a document about bricks and mortar – a commercial arrangement between landlord and tenant concerning a physical asset. Data protection law does not always see it that way. This article addresses an increasingly pressing question for property professionals: when does information collected during a property transaction or tenancy constitute personal data under the UK General Data Protection Regulation (UK GDPR)?

The answer is far from obvious. It arises across the range of data routinely collected by landlords, housing associations, managing agents and property lawyers – from recording a tenant’s choice of property size or kitchen fitting, to gate access data monitoring who enters and exits a building. If that information identifies a living individual, it will attract the full suite of UK GDPR obligations, with potential negative consequences for organisations who fail to recognise it as such and comply.